CVE-2026-49014

Vulnerability

In GDAL versions 3.1.0 through 3.13.0, the function scanForGeometryContainers in frmts/netcdf/netcdfsg.cpp reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. This allows an attacker to trigger a stack-based buffer overflow by providing an oversized geometry attribute in a crafted NetCDF file. No special configuration is required; the vulnerability is reachable simply by opening a malicious file with GDAL [1].

Exploitation

An attacker needs only to craft a NetCDF file containing an oversized geometry attribute. If the server or application processes user-uploaded NetCDF files, no authentication or special network position is required. When GDAL parses the file, the scanForGeometryContainers function copies the attribute into a fixed-size stack buffer without bounds checking, causing a buffer overflow that can be leveraged for arbitrary code execution [1].

Impact

Successful exploitation allows the attacker to achieve arbitrary code execution on the server running GDAL. This results in full compromise of the application and potentially the underlying host, leading to loss of confidentiality, integrity, and availability [1].

Mitigation

As of the publication date, no official patch has been released. The issue report recommends using the existing helper function that calls nc_inq_attlen() to validate attribute length before reading, as already done elsewhere in the same file [1]. Until a fixed version is available, users should avoid processing untrusted NetCDF files. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.